Django-bcrypt - <AUTHOR> https://github.com/dwaiter/django-bcrypt/ <comment><AUTHOR> Step 1: Install

Step 2: Add to INSTALLED_APPS

Step 3: Enjoy more secure password hashing.

...

Step 4: Set BCRYPT_ROUNDS to something higher than 12 when computers get faster.

<comment><USER2> You sir, are a machine. Steve started working on this 3 feet behind me a little less than 2 hours ago.

<comment><USER3> It took him two hours to monkey patch a few methods?

<comment><AUTHOR> Actually the code was already written -- see the bottom of the README.

It took about 30-40 minutes to:

* Add the BCRYPT_ROUNDS setting.

* Remember how to allow for an optional setting (`if foo in settings` and `settings.get(foo, default)` don't work).

* Add the setup.py file.

* Write a README.

* Test with a real Django site to make sure nothing was broken.

* Create and push to repos on BitBucket and GitHub.

<comment><USER4> _> Remember how to allow for an optional setting (`if foo in settings` and `settings.get(foo, default)` don't work)._

Instead of:

        settings.get(foo, default)

Try:

        getattr(settings, foo, default)

This looks useful. Thanks.

<comment><AUTHOR> Good idea, pushed!

</comment></comment></comment></comment></comment></comment><comment><USER5> Is it just coincidence that I wrote almost-identical code about 7 hours before this? (<https://github.com/playfire/django-bcrypt/>)

</comment><comment><USER6> Bcrypt (or scrypt) should actually be used as default for password hashing in application servers. Using something like crypt/md5/sha-1 hashing per default is just completely irresponsible.

<comment><USER7> Why bcrypt should be used instead of sha-1 ? (I am genuily asking, I don't know anything about security).

<comment><USER8> Essentially, because it's slow.

SHA is designed to be fast, so dictionary attacks can find huge amounts of matches nigh-instantly, and rainbow tables (or GPU EC2 instances!) exist to brute-force up to 8-12 characters, more than enough to crack most people's passwords. You can salt the hash (basically: pre-pend a unique string to the password) to defeat rainbow tables, but SHA doesn't do this by default. You can SHA something more than once to slow things down, but SHA doesn't do this by default (and rainbow tables still work - they're _based_ on repeated hashings).

BCrypt is slow by design (ie, thousands of times slower). It's a much-harder calculation, and it automatically _uniquely_ salts what it's hashing, and you can make it more secure incrementally by simply running it through more steps (it's designed to do this). The speed isn't noticeable to a user while logging in because checking if their password is correct is still extremely quick, but attempted-brute-forcers run up against a brick wall as their attempts are now rainbow-table-proof and slower by orders of magnitude. Best of all: it does all this _by default_ , and it stores all the necessary information in the result so comparing values against it is fool-proof. You can't mis-use it.

SCrypt takes all the advantages of BCrypt and goes a step further: it guarantees that a certain amount of memory (ie, large) is required to perform the hashing function. So while SHA / BCrypt can still be attacked more quickly by, say, performing a thousand operations at a time through custom hardware, SCrypt can demand so much memory that it's simply infeasible to do so, so you're stuck testing one. password. at. a. time. It's the ultimate death to brute-forcing, basically.

</comment></comment></comment><comment><USER9> bitbucket repo: <http://bitbucket.org/dwaiter/django-bcrypt>

<comment><USER10> I haven't done a diff, is the bitbucket or github repo "official"?

<comment><AUTHOR> Technically BitBucket (the GitHub one has "mirror of django-bcrypt" as a description), but I try to always push to both at the same time.

I'll take patches/pull-requests from either.

</comment></comment></comment><comment><USER11> Unfortunately, for a lot of us working in locked down environments, this code makes use of the py-bcrypt module which uses the bcrypt C implementation. If you're running on GAE, you're out of luck. I keep telling myself to port to pure Python, but haven't had time. Anyone interested?

<comment><USER12> There's a pure-Python implementation of PBKDF2. I know it's not as good as bcrypt or scrypt, but at least it's better than MD5 or one of the SHA's.

<comment><USER13> I saw a Twitter discussion with Colin a couple weeks ago here he pointed out that Python no longer guarantees constant time for all of the basic binary operations like addition (since fixed width integers can spill over to arbitrary precision math if you overflow them, or breathe on them wrong).

Be careful.

<comment><USER14> Side channels don't matter for bcrypt.

<comment><USER13> Can you explain why this is? (Not doubting you; just curious.)

<comment><USER14> The online operations exposed to an attacker in a bcrypt system are done almost entirely on attacker-known data.

</comment></comment></comment></comment></comment></comment><comment><USER10> What were your timings like for bcrypt using 12 rounds? Also, while for the SHA-x algorithms, there have been numerous tests--what about for the pycrypt module?

<comment><AUTHOR> Timings are going to be completely dependent on the server. Anything I tell you will be wrong unless you're running on my server.

And I didn't test any SHA-x algorithms. Any algorithm that has a time you can't easily increase by tweaking a number (BCRYPT_ROUNDS) will eventually become insecure as computers get faster.

<comment><USER15> It's not straight SHA-x, I'd wager; glibc includes a version of phk's MD5-based crypt() based on SHA2 (with some bonus insanity thrown in; it's a spawn of MD5 crypt and Drepper, after all.)

Like md5crypt, this new crypt() is not based on established cryptographic principles.

</comment></comment></comment><comment><USER16> Does anyone know how to use bcrypt on App Engine? py-bcrypt is not pure python and hence can't be used.

<comment><USER17> I don't know of any pure-Python bcrypt implementation, but App Engine will let you calculate SHA-1 hashes with the built-in hashlib module. To make this slow enough, you'll need to iterate it a bunch of times (at least 1000 is the usual recommendation). Something like this:

        import hashlib

        def slow_hash(password, salt, iterations=2000):
            h = hashlib.sha1()
            h.update(password)
            h.update(salt)
            for x in range(iterations):
                h.update(h.digest())
            return h.digest()

I haven't tested this code, but hopefully it illustrates the general idea. Repeatedly run the hash function on the output of the previous iteration. You may need to bump up the number of iterations later as computers get faster. It's not as good as bcrypt, but it also doesn't suck, and it should run just fine on App Engine.

</comment></comment><comment><USER18> I thought I remember a post a while back but:

What is the cost (time) of using bcrypt instead of the default?

<comment><AUTHOR> Pretty much anything you want it to be. The higher the work factor (BCRYPT_ROUNDS in this app), the more time it takes. That's the beauty of bcrypt.

<comment><USER15> That said, you might want to scale it back a little. 2^12 rounds takes 1-2 CPU seconds (on a different implementation, but still.)

</comment></comment></comment><comment><USER19> next step is to make this the default. unfortunately the django overlords think it's not important enough to be default.

<comment><USER20> A few things:

First, There's no such things as "the django overlords". We're an open source community of thousands. Hundreds contribute. Dozens have commit access.

Vry few among these contributors, and none (that I know of) on the commit team thinks that bcrypt support "is not important." If you'd like to prove me wrong, please cite your source.

Now, this has been proposed a few times (<http://code.djangoproject.com/ticket/5787>, <http://code.djangoproject.com/ticket/5600>). Each time, substantive problems with the approach have been found. A few choice quotes from the discussion should illustrate the issues:

Me, on #5600: "[T]here's a problem with supporting any hash schemes not in Python 2.3 (our lowest supported Python version): it means databases created with a different version of Python break when used under a lower one." (Now it's Python 2.4, and 2.5 soon, but the problem still holds.)

Malcolm, on #5787: "As soon as you start generating passwords that are only computable based on an optional model, the database can only be used with Django installations that have that model available. This removes the ability to move the database around easily. Django operates on a "batteries included" philosophy for exactly that reason: runs anywhere without lots of extra dependencies."

Worse, this third-party module (i.e. Python bcrypt module), last I checked, failed to build on Windows. As much as I hate supporting Windows, I recognize why we have to.

What I'm trying to say is that the issue is technical, not personal or political as you seem to think. If the technical issues can be overcome, I don't see why bcrypt support couldn't be the default.

Finally, I'll close with the obligatory note that open source projects get driven forward by people scratching their own itch. If this bothers you, fix it. If your fix is rejected, try again. If you think we're a bunch of asshats, fork the project. Do any of those things, and I'll respect you. Complain and sling personal attacks and I won't.

<comment><USER21> If you can't hash passwords properly, you shouldn't be dealing with passwords at all. It's just damned irresponsible.

 _"the django overlords"_ _"Dozens have commit access."_

I suspect that's what he meant.

<comment><USER20> > It's just damned irresponsible.

Since you feel that strongly I can expect to see a patch from you fixing the technical issues I mentioned, right? You write it, I'll commit it. Go.

<comment><AUTHOR> Look, I love Django, but to be fair this is kind of a bullshit response.

There are things I hate about Git, and I could fix them myself, but I don't submit patches to Git. I just use Mercurial instead.

"Send patches" isn't a be-all, end-all response to any criticism of an open source project.

<comment><USER20> You're right. I get kinda pissed when people call me "dammed irresponsible" because I can't find the time to solve some technical problems. It implies a sense of entitlement to my time that rubs me the wrong way.

You did exactly the right thing: figured out how to solve the problem regardless. _That's_ something that'll motivate me; calling me stupid or irresponsible won't.

So yeah, you're right, it is bullshit, and so is the attitude I responded to. Garbage in, garbage out, I suppose.

<comment><AUTHOR> Having several open source projects of my own, and contributing to a few more, I definitely know how you feel.

Here's what I want to know about this in a nutshell:

Does Django (the project as a whole) want to provide the best possible security, within reason, for its contrib.auth module?

If not, why not, and why isn't it stated prominently in the documentation?

Is bcrypt not the best possible security, or reasonably close to it?

If not, why not? I'm not even remotely close to a cryptography expert, so although bcrypt's support for arbitrary work factors seems to provide very good security to me I know I could very well be horribly wrong in this thinking.

Is providing bcrypt hashing for passwords in contrib.auth not within the realm of reasonable effort? This could mean rewriting bcrypt in pure Python and including it in contrib, to support Windows users.

If not, why not? Perhaps rewriting bcrypt in Pure Python is not easy -- I haven't tried it myself.

If bcrypt hashing is secure and reasonable to implement, and Django wants to provide the best security possible (within reason), why is this not a blocking issue for Django 1.3?

I genuinely don't know the answers to any of these questions, so I'd really love to know.

<comment><USER20> > I genuinely don't know the answers to any of these questions, so I'd really > love to know.

Well, I don't speak for the project as a whole, so I'm going to just answer personally. I'll try to channel the rest of the core team as best I can, but please don't take any of the below as any sort of "official" thing. I may very well have a different point of view or be in the minority -- I often am, actually.

> Does Django (the project as a whole) want to provide the best possible > security, within reason, for its contrib.auth module?

I certainly do, and I'm sure the rest of the team feels similarly. We take security issues very seriously and I'm disappointed we've not been able to demonstrate that through our past actions (i.e. built-in XSS and CSRF protection, our security releases, etc.) This indicates to me that we haven't done a good job being clear about our goals with regard to security. So that's something to work on.

I think, though, that reasonable people can -- and do -- disagree about what "within reason" means. I mean, are we building Django to protect against script kiddies? Malicious employees? Corporate espionage? Government agencies?

Me, I suspect I'd choose to fold in the face of a lawsuit or subpoena, so I don't particularly care if my passwords are safe against the NSA or something. But that's because I'm a spoiled comfortable middle class yutz.

> Is bcrypt not the best possible security, or reasonably close to it?

Personally I have no idea. I'm not a security expert, nor am I even a well- informed amateur. I've read (here and on Reddit, mostly) that bcrypt is the best there is. I've read that bcrypt is for lamers and scrypt is better. I've also been told that salts & sha1 is fine. I've also been told that sha1 will eat my children and burn my house down. I'm honestly not qualified to judge.

Given what I know, my feeling is that bcrypt/scrypt is certainly an improvement over sha1, and probably an improvement over any sha version. I'm not convinced that it's an improvement over, say, multiple rounds of a sha algorithm.

More importantly, I'm not clear on exactly how big a deal this is. There's a spectrum: at one end, we activate our security policy, halt everything, and release new versions, damned the backwards compatibility concerns. At the other end of the spectrum we do nothing. I really don't know where on this spectrum the issue falls. I suspect that it's somewhere a bit more serious than the potential timing attacks we just fixed in trunk, but maybe a bit less serious than the DOS attack our last security release fixed.

> Is providing bcrypt hashing for passwords in contrib.auth not within the > realm of reasonable effort? This could mean rewriting bcrypt in pure Python > and including it in contrib, to support Windows users.

Of course it's possible, but the devil as they say is in the details. I think it should be possible to support bcrypt if it's installed, but the concerns about data portability need to be addressed in some way. At the very least there should be some "I don't care about data portability" flag you can set to turn on bcrupt support.

A pure-Python bcrypt implementation would certainly help. But _I_ certainly am not going to rewrite bcrypt -- I know enough about crypto to know that I shouldn't be allowed with a thousand miles of writing an algorithm by hand. And frankly there aren't any active committers I'd trust to write such an implementation. It would have to come from a pretty unimpeachable source, wouldn't you agree?

> If bcrypt hashing is secure and reasonable to implement, and Django wants to > provide the best security possible (within reason), why is this not a > blocking issue for Django 1.3?

Because nobody proposed it and we're well past feature freeze for 1.3 and very close to cutting a release candidate. Also because there's a great third-party app that provides this feature in a very easy-to-use way :)

But If a majority of the community wanted to make bcrypt (or whatever) a blocking feature for 1.3 then I'd go along with it. I'd argue against it, but again I'm just one voice. A loud one, maybe, but I'd like to think I can take being wrong graciously. I was against template auto-escaping originally, for example, so clearly I'e already got a good track record of being wrong about security.

I hope that helps; it's late and I've had a long day. Please ask if I'm not being clear.

<comment><AUTHOR>
       I think, though, that reasonable people can -- and do -- disagree about what "within reason" means.

Absolutely, which is where my next questions come from.

        I'm not convinced that it's an improvement over, say, multiple rounds of a sha algorithm.

Sure, for this conversation feel free to replace "bcrypt" with "configurable rounds of SHA1".

        More importantly, I'm not clear on exactly how big a deal this is.

I agree here.

Yes, bcrypt is better.

Is it "better enough" to warrant backwards-incompatible changes? Maybe not.

I'm not clear on Django's database-compatibility policy though. Are databases created with Django 1.X guaranteed to work with Django 1.Y (where Y < X)? If not, then there are no problems. If so, then you're right, a backwards incompatible change like this is not trivial.

Maybe I completely missed this in the docs.

        At the very least there should be some "I don't care about data portability" flag you can set to turn on bcrupt support.

This goes back to my question about databases working with older versions of Django. Did I miss an important part of the docs?

        A pure-Python bcrypt implementation would certainly help. But I certainly am not going to rewrite bcrypt -- I know enough about crypto to know that I shouldn't be allowed with a thousand miles of writing an algorithm by hand. And frankly there aren't any active committers I'd trust to write such an implementation. It would have to come from a pretty unimpeachable source, wouldn't you agree?

This is the first argument that really convinces me. If you need to support Windows and don't have anyone you trust to write a real crypt implementation in pure Python, that kind of kills the idea in its tracks.

A third-party app usable by non-Windows-users seems like the best option.

        I hope that helps; it's late and I've had a long day. Please ask if I'm not being clear.

Definitely. Thanks for taking the time to answer.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


What Went Wrong with the F-35, Lockheed Martin's Joint Strike Fighter? (2017) - <AUTHOR> https://www.scientificamerican.com/article/what-went-wrong-with-the-f-35-lockheed-martins-joint-strike-fighter/ <comment><USER2> The article is a year old and parrots some of the talking points from the F-16 vs F-35 exercises that definitely didn't reflect the full capabilities of the two aircraft.

The F-35 at the time was flying with its flight envelope restricted by software, and the test pilots involved were not really doing an all out dogfight but were instead working on determining the F-35's flight envelope and how it responded to different tactics.

In general the article just does the same thing as others, repeats stuff from blogs and so called "experts", people who have probably never even touched and F-35 much less flown one.

It does seem to be a fun topic for clickbait though.

<comment><USER3> And adding to that that the only nation to use it in combat so far is Israel and they seem to like it (they are the only nation to increase their order after using it in theater) and despite theirs being heavily modified I would err on the side of caution swallowing these gloomy statements that seem to have more problems with the politics and funding of the program than with the jet itself.

The same things were said about the F16 in it's early days. And in fact it was the IAF that proved that it was suited for both long distance combat sorties and old school bomb sights bombing runs when they used it to take out the Osirak nuclear reactor in Iraq which proved many F16 critics at the time wrong.

The truth is that these days no replacement for a fighter jet would be that much superior to what it's replacing not because it's poorly designed but because what it's replacing has had 40 years worth of improvements and refinements.

Block 70 F16s have nearly nothing in common with the original fighting falcon there likely isn't a single part that is even interchangeable between them.

That said the F16 unlike the F35 doesn't have another 40 years it's air frame has already been stretched (literarily) beyond its limits so we do need a new platform regardless of its growing pains.

And for people criticizing the F35 over its low order numbers well they are low compared to the F16 but the F16 has been in service for 40 years and introduced during essentially the largest arms race the world has ever seen aka the Cold War.

<comment><USER4> _The truth is that these days no replacement for a fighter jet would be that much superior to what it's replacing not because it's poorly designed but because what it's replacing has had 40 years worth of improvements and refinements._

What is the scope of the improvements and refinements?

I'm hard-pressed to think of something you could replace "fighter jet" with and have the statement be true.

Computer? Automobile? Spacecraft? Telephone? Probably not. Dwelling or building? Potentially...

Is this a Ship of Thesius situation where every part of the F-16 has been redesigned and replaced over time, but it's still called "the F-16"? Was forward-compatibility a design goal? Was it just designed at a time where the state-of-the-art was at a 'sweet spot' of sophistication such that the overall structure had design longevity but the guts could be replaced?

<comment><USER3> >What is the scope of the improvements and refinements?

The current F16 has very little in common with the original one that entered into service in 1978, even the air-frame was redesigned several times, new engine, new avionics new everything, the modern F16 blocks (C 50/52 onward) are like 6000 lbs heavier (naked) than the F16A naked while having a longer range and larger carrying capacity.

>Computer? Automobile? Spacecraft? Telephone? Probably not. Dwelling or building? Potentially...

Yes and no, in this analogy the F16 isn't a Laptop Model X123 but rather just a "Laptop", in the desktop PC world just a "case" and on top of that if the case could also be heavily modified.

[https://en.wikipedia.org/wiki/General_Dynamics_F-16_Fighting...](https://en.wikipedia.org/wiki/General_Dynamics_F-16_Fighting_Falcon_variants)

And in space you can see it today take a look at Space X and the differences implemented in Falcon 9 during it's development from block to block.

[https://en.wikipedia.org/wiki/Falcon_9#Launcher_versions](https://en.wikipedia.org/wiki/Falcon_9#Launcher_versions)

</comment></comment></comment></comment><comment><USER5> I worked on the Boeing-Sikorsky Comanche helicopter. That aircraft was also intended to be a multi-role aircraft, intended to provide stealthy armed reconnaissance and attack roles. The project was canceled after investing approximately $7 billion.

Multi-role aircraft are intended to save money, and it sounds like a good idea. You save money training pilots and ground crew. You save money with parts, support equipment and logistics. Unfortunately, the multi-role aircraft don't do the individual roles as well as aircraft designed specifically for the individual roles. I have yet to be convinced that the F-35 will be able to do close air support as well as the A-10.

When you put together the Marine Corps, the Navy and the Air Force requirements, it's really hard to come up with a multi-role aircraft that does each role well.

<comment><USER6> To be fair, each service has its own variant. That's increased cost, but each service should have aircraft that'll work well for the individual service's requirements.

The F-15, F-16, and F-18 are all multi-role aircraft, and are fairly unarguably the world's best in their categories. There's no reason to think the F-35 won't be in the same class.

As to the A-10, I believe the F-35's primary ground support approach will be from pretty high altitude, using smart weapons. That kind of approach will even work against first-tier opponents.

If you need "low and slow" close air support while shooting up the enemy with cannon, the Apache seems a better fit. The AC-130 is somewhere in between...note recent AC-130 variants have been getting longer and longer range weapons to decrease vulnerability to MANPADS.

</comment></comment><comment><USER7> Will the f35 still be stealthy in 10 years against improved DSP capabilities?

My understanding is that if slap a super computer on top of the current radar systems, you can kinda of maybe possibly triangulate a F35. And DSP can be scaled up horizontally with cores...

(I am not an expert on radars, planes, dsp, etc)

<comment><USER3> The F35 in 10 years won't have much in common with the F35 today just like a block 70 F-16 has nothing in common with the original F-16A, there is literarily not a single part that is interchangeable even the entire airframe is different between the F16s flying today and those which took off during the Cold War.

</comment></comment><comment><USER8> Is there some reason why there are so many F35 articles on HN recently? Is there an anniversary coming up or an appropriations bill? Is someone shorting Lockheed Martin?

<comment><USER9> There was a long twitter thread that was very anti F-35 going around.

<comment><USER10> Could you please provide a link?

</comment></comment></comment><comment><USER11> Can someone explain to be like a I'm a five year old why these planes cost much more than say a commercial airliner and the differences apart from the obvious speed, agility and missiles?

<comment><USER12> Defense contract gravy train.

<comment><USER11> To be honest this is what I thought and had suscipions of most, I get the rnd costs but there aren't many defense contractors so they can charge what they like

</comment></comment></comment><comment><USER13> It is turning out that remote piloted fighting planes, without the fragile human cargo, can out-turn, out-brake, and out-accelerate the old line manned fighters. In many ways you can add 'smarts' to any missile to make it a very good one shot attacker. With no human on board the weapon load can be 5 or more times larger. In addition, the cost declines. In addition, with modern missiles, even a stealth fighter is an easy target now they use the newer multi emitter radar. (multi emitter radar has many radar transmitters/receivers at separate locations that exploit the specular aspects of stealth planes. Every cell tower can be used as one of these sites with data processing finding the shape of the plane in the sea of clutter). If the US is smart, they will switch away from manned and to remotes, like Russia has indicated they are doing.

<comment><USER14> It would be nice if you could back-up any of your claims with some supporting information.

If that were the case, why wouldn't the world's premier warfighting nation instead be creating such a project, graft and all, instead?

Perhaps the answer is that the F-35 still fulfills a very real, very important role and that all of the FUD around it is just that. FUD.

<comment><USER15> I'm not the person you were responding to, nor do I claim any knowledge of jet fighters, but at a top speed of Mach 1.6 (1,200 mph), it would seem to me that relaying data back and forth from the jet would be a serious technical challenge.

A pilot on board the jet receives input from the environment with effectively 0 latency, and responds with 0 latency as well. The only latency would be human reaction latency, which the remote pilot would have to. Except that remote pilot would also have to contend with network latency to a plane that's thousands of miles away.

That's assuming the connection doesn't break, which with a plane moving away at 1,200 mph in various arbitrary directions, seems likely.

<comment><USER16> > A pilot on board the jet receives input from the environment with > effectively 0 latency, and responds with 0 latency as well. The only latency > would be human reaction latency, which the remote pilot would have to. > Except that remote pilot would also have to contend with network latency to > a plane that's thousands of miles away.

Also remotely operated planes can be disabled by disrupting the communications link. A piloted plane is still able to operate in a degraded mode in an environment where communications links are disrupted.

If the USAF went all-in on remotely operated planes, that could incentivize adversaries to increase investment in technology to disrupt the links that control them, since such technology could deliver air-superiority against an all-remote air force in a single action.

<comment><USER13> so true, and deep scrambling involves longer delays - delays you do not have. You can have local pilots 10-15 miles out with fighting robots as the tip of the spear.

Read about how the Air Force shrunk the coding procurement link - which was 3-4 years deep</comment></comment></comment></comment></comment>


IndexedDB has much to learn from SQLite - <AUTHOR> http://lists.w3.org/Archives/Public/public-webapps/2011AprJun/0050.html

<comment><AUTHOR> The web would be healthier if it had two competing APIs in SQLite and IndexedDB.

Mozilla must come to the party and provide access to an embedding of SQLite.

It would be hubris to suggest they can design something better and to remove the alternative before they have done so.

<comment><USER2> I think I can see both sides of this argument - on one side there is the fact that SQLite is available, is a great bit of software and is already built into a number of browsers, on the the other hand it does seem slightly odd to have specification that references an implementation ("do whatever version X.Y.Z of SQLite did).

If they supported both then everyone would probably use SQLite and the standard Web stack becomes directly dependent on a particular _implementation_ of something - which I don't think has ever been the case before.

Personally, I'd go with SQLite, preferably with a synchronous interface as well. But I can understand the reservations of those who don't.

<comment><USER3> Mozilla's plan is to implement IndexedDB on top of SQLite, and then encourage developers to re-implement SQL in Javascript on top of _that_.

[https://hacks.mozilla.org/2010/06/beyond-html5-database- apis...](https://hacks.mozilla.org/2010/06/beyond-html5-database-apis-and-the- road-to-indexeddb/)

Sounds to me like a ludicrous hoop to make people jump through just to avoid an ad-hoc standard based on an implementation.

<comment><AUTHOR> Yes, except Mozilla have to yet to show that it can be done. They are yet to understand that IndexedDB does simply not provide enough low-level primitives to implement SQL let alone have even a chance of coming within 10 orders of magnitude of the performance of SQLite.

There's a design flaw in IndexedDB, namely IndexedDB does not regard objects as opaque. This is the first thing you'd need (followed by variable length records) if you wanted to implement SQLite on IndexedDB.

Ships will sail around the earth but the flat earth society will flourish.

</comment></comment></comment></comment><comment><USER4> [http://lists.w3.org/Archives/Public/public- webapps/2011AprJu...](http://lists.w3.org/Archives/Public/public- webapps/2011AprJun/0053.html)

^ that post is infinitely more interesting (the argument for RelationalDB)

[http://lists.w3.org/Archives/Public/public- webapps/2011AprJu...](http://lists.w3.org/Archives/Public/public- webapps/2011AprJun/0055.html)

^ click "stored" after "text/html attachment" (an argument against RelationalDB)

</comment><comment><USER5> "... and with better test coverage at that."

Oh wow. I thought he was serious until he was suggesting there exists software in the world with a more comprehensive test suite than SQLite.

</comment><comment><USER6> flamebait link to a mailinglist rant

<comment><AUTHOR> It's a pivotal thread, it's not a rant. It's likely that Mozilla may provide access to an embedding of SQLite, if enough developers pay attention to these discussions now. If you have already used IndexedDB to store more than 500,000 objects on an iPad and you were satisfied with it, and it didn't crash, then I would rest my case.

<comment><USER7> To reinforce your point, I stored about 70,000,000 rows in one table in a SQLite database and a few million rows in other tables on the same database, and it was fast, reliable and delightful to work with. Anyone who goes against SQLite will have a _lot_ of work ahead of them.

<comment><USER8> I've also worked with SQLite, and one project was the using the C API. It's also why I really liked Google Gears.

Here's the Google Tech Talk on SQLite from 2006 [http://www.youtube.com/watch?v=giAMt8Tj-84&feature=chann...](http://www.youtube.com/watch?v=giAMt8Tj-84&feature=channel_page)</comment></comment></comment></comment>


Show HN: our new store page.  Any feedback/suggestions? - <AUTHOR> http://www.scirra.com/store

<comment><USER2> I think it looks really nice! if i really had to criticize something it would be that the login/register links look quite out of place! but other way is nice.

</comment><comment><USER3> I didnt expect the transitions when I mouseover'd the product. Users are used to clicking on the photo to get more info. Not sure if Add to Cart would be a common use case from the splash page.

</comment><comment><USER3> A description of what your store sells in the header or sidebar would be nice.

<comment><USER4> Thanks! Great suggestion, to us as developers its obvious because we've spent ages developing it so it's good these obvious things are pointed out to us

</comment></comment><comment><USER5> I noticed one thing. You have prices displayed in $ on home page but in pounds on the store page ?

<comment><USER4> Thanks for pointing that out! I'll add this to my things to fix.</comment></comment>


Clear's UI in HTML 5 - <AUTHOR> http://clear.youyuxi.com/

<comment><USER2> It has already been submitted 2 days ago - <http://news.ycombinator.com/item?id=3618387></comment>


What If Banks Were Publicly Owned? In LA, This May Soon Be a Reality - <AUTHOR> https://www.huffingtonpost.com/entry/public-bank-los-angeles_us_5b6bef33e4b0ae32af954495 <comment><USER2> _Because a public bank is not a for-profit business, it can offer lower interest rates than private options, saving billions of dollars over time. And because the city owns the bank, any interest income would flow back into its coffers. That reduces financing costs and facilitates more lending. Plus, the money stays at home, circulating in the local economy rather than traveling into an investor's pockets or a risky trading scheme._

I don't think this is well thought out.

They are ignoring opportunity cost. If the city lets a bank hold $1B, they get X amount in interest. If they pull that money out and lend it at a lower rate, they will get a smaller return. That's not "saving billions" at all.

I get the sense the people who thought this up have little to no understand of how finance works.

<comment><USER3> Your argument sounds a lot like, "if they buy apples at $1 and sell them at $0.95, they'll loose money"

It is in fact possible to loan out money at a lower interest rate than a private bank while simultaneously collecting a higher rate than the bank pays on deposits because the bank doesn't lend at the same rate it pays out. The larger that spread, the more sense this idea makes. Seems like an elementary mistake for someone leveling the accusation that the scheme isn't well thought out. Surely there's more to your critique than this.

<comment><USER2> Explain this particular sentence... _Because a public bank is not a for-profit business, it can offer lower interest rates than private options, saving billions of dollars over time._.

Where are the "savings"? This money was originally _earning_ interest, not costing money.

And of course they need to incorporate the default rate on their loans, which would lower the overall return.

Overall, a very hand wavy plan.

<comment><USER2> And looking at the Bank of North Dakota, it indeed looks like they don't save any money at all.

 _The vast majority of funding for the Bank of North Dakota comes from deposits resulting from tax and fee collections. The bank essentially offers below market rate loans by paying lower deposit rates back to the State, ultimately costing the taxpayer._ [1]

[1][https://www.denverpost.com/2015/03/04/colorado-would-be- wise...](https://www.denverpost.com/2015/03/04/colorado-would-be-wise-to- reject-state-owned-banking/)

<comment><USER4> I look at it this way: Scenario A: city deposits their funds in a private bank where the funds earn a 1% interest rate. The private bank lends funds at 5% interest. The bank keeps the 4% difference. Scenario B: city keeps their funds in a public bank. The public bank pays out interest at 2% and lends at 4%. Now the city is keeping the 2% difference with the added benefit of total control over its funds.

<comment><USER5> > The private bank lends funds at 5% interest

Hang on.. is that the _rate_ the bank is lending at, or their yield, including any losses from things like defaults and costs?

> the added benefit of total control over its funds.

Actually, not quite, because one no longer has _control_ of any funds that were lent out.

If a disproportionate number of borrowers all miss a payment during a particular month (even if the don't outright default and catch up next month), the city/bank will have to borrow those funds from the Fed. This can also happen if the city isn't the only depositor and there's a "run" on the bank. That borrowing, short-term though it may be, adds cost, and the rate is (occasionally) variable, unlike, say, many mortgages.

The point is, understanding interest rate spread is simple enough, but the reality (especially with fractional-reserve banking, which is another can of worms) is far more complicated. What seems obvious when explained with the simple model isn't actually so.

</comment></comment></comment></comment></comment></comment><comment><USER6> Whenever I see articles like this the questions that occurs to me is: Why limit this to banks? Why not have a publicly owned restaurant? Convenience store?

<comment><USER7> Banks are literally the cornerstone of the economy. I'm not aware of any restaurants of convenience stores that are even close to being as critical or 'too big to fail.'

<comment><USER8> Banks aren't too big to fail just because they are banks. If they weren't allowed to get so big or merge together, they they wouldn't be too big to fail.

<comment><USER7> I never said that, but I'll clarify: They are too big to fail because we have allowed them to become too big to fail.

<comment><USER9> They're too big to fail because politicians decided they were. Of course, they aren't _actually_ too big to fail. In the financial crisis, if they hadn't bailed out the banks, they'd either be acquired by competitors, or go out of business and people would have actually learned their lessons to not take on excessively risky assets. Instead, the government bailed out the banks, essentially telling them that they should take on whatever risk they want, because they'll just be bailed out whenever they fail.

</comment></comment></comment></comment></comment><comment><USER10> So it seems like the core issue they're trying to solve is Los Angeles's portfolio is too large to manage at a community bank[1], because it's too risky. And the solution is to create a single customer bank?

It would seem to me that the way to manage this is to either use the large size of the portfolio to demand concessions from commercial banks, or split up the banking needs over several banks -- although it's probably difficult to split over enough to be able to use the services of even the largest community banks. The article reports $101 Million on deposit with Wells Fargo at some point, that's just a huge amount; more than 1% of total assets for most credit unions (all except the top 7 [2])

[1] I'm going to use bank, when it could also be a credit union, since for most purposes they're interchangeable.

[2] [https://www.mx.com/moneysummit/biggest-us-credit-unions- by-a...](https://www.mx.com/moneysummit/biggest-us-credit-unions-by-asset- size)

</comment><comment><USER11> Dexia and Belfius are state owned in Belgium since the state bailed them out in 2008. Same for Ethias, an insurance company.

</comment><comment><USER12> All they have to do is study how the Indians did it - under Mrs. Indira Gandhi's leadership, at one go, all private banks were nationalised in India and the ownership transfered to the government who ran it; 30+ years down the lane, India now also allows private and foreign owned banks with strict regulations.

</comment><comment><USER13> What if currency were privately printed?

<comment><USER14> If by currency you mean paper and not coins, this is already the case. The Fed is a private institution with a government mandate to print paper money. The plates are owned by the U.S. Treasury, but the printing is performed exclusively by the Fed authorized by the Federal Reserve Act.

Because the U.S. Constitution authorizes coining but not paper currency, and the Federal Reserve Act authorizes the Fed to print paper, it's something of an open question to what degree the printing of paper currency is an exclusively federal power. But in practice anyone trying to print a competing paper currency domestically gets stomped on. As far as I'm aware though, it's untested if a state could print its own paper money - but to what end? I think it's a hypothetical really only of interest to monetary economists and perhaps some fringe politicals, which is where it would need to be explored substantially before it could ever emerge practically.

There are historic cases of private banks issuing paper money in the U.S., but it usually degraded into distrusting the currency, one exception being the Suffolk Bank system, but even that eventually came to pass. You could argue that your VISA, MasterCard, or Amex card is a private "currency" with a fixed exchange rate 1:1 with the card's issuance currency. By offering you a line of credit on the card, they've "printed" their own private currency, with an externally facing dollar (or whatever the currency happens to be in the card's issuing location). But as it's not in physical paper form, it's sorta shrugged off as a convenient derivative rather than a competitor.

And so back to the public bank question, most countries do have them. Their central bank is publicly owned. Bank of Germany, the Bank of Canada, the Bank of Mexico, etc.

<comment><USER15> >...There are historic cases of private banks issuing paper money in the U.S., but it usually degraded into distrusting the currency, ...

I don't think that was the general case at least with the bank notes issued by the national banks after the civil war:

>...From 1863 to 1935, National Bank Notes were issued by banks throughout the country and in US territories. Banks with a federal charter would deposit bonds in the US Treasury. The banks then could issue banknotes worth up to 90 percent of the value of the bonds. The federal government would back the value of the notes—the issuance of which created a demand for the government bonds needed to back them.

>The program was a form of monetization of the Federal debt. Bonds eligible as collateral for posting to the Treasury were said to have the "circulation privilege" and the interest they bore provided seigniorage to the National Banks.

[https://en.wikipedia.org/wiki/National_Bank_Note](https://en.wikipedia.org/wiki/National_Bank_Note)

The program was run for over 70 years, it was only with the Great Depression and the desire to have the Fed have greater control over the money supply that the program ended.

</comment></comment></comment><comment><USER16> That's called a Credit Union. Not a new idea....

<comment><USER17> A credit union is a non-profit. A non-profit can be owned by a government or an individual, similar to how a for-profit can be owned by a government or individual. In other words, the two descriptions are completely orthogonal.

Most credit unions (really, the vast majority) are privately owned, typically by the account holders themselves.</comment></comment>


Is Apple's aesthetic fundamentally inhuman? - <AUTHOR> http://edcooke.memrise.com/2011/05/is-apples-aesthetic-fundamentally.html

<comment><USER2> In terms of the "cold sterility of their design," I only have this to say:

In industrial design, minimal is a synonym for good.

</comment><comment><USER3> Apple won't do things for me for free. They are INHUMAN!!!</comment>


Raising the fed min wage to $15 by 2024 would lift pay for nearly 40M workers - <AUTHOR> https://www.epi.org/publication/raising-the-federal-minimum-wage-to-15-by-2024-would-lift-pay-for-nearly-40-million-workers/ <comment><USER2> An interesting thing about the minimum wage is that it isn't one. We allow $0 per hour. (called "volunteering") We allow negative numbers. (called "education" or "training")

It's just a narrow range of values that is forced into the black market.</comment>


Reverse Engineering Vendor Firmware [video] - <AUTHOR> https://www.youtube.com/watch?v=j5NciKpHZzs

<comment><USER3> This is a great talk.

There's a reason many reverse-engineers drink so much. It's because we have to look at someone else's code and figure out what they were thinking - <USER2> sometimes, the thing foremost in our mind throughout that process is: _what the hell were they thinking?!_

The things I've seen...

\- Interrupts which relied on no-one using the debug registers (deliberately).

\- I've seen copy protection faults which quit to desktop releasing a bootsector virus linked in when triggered. (Yes, 'virus protection' really existed, but I only saw it once.)

\- Highly expensive dongle hardware whose entire purpose was being a 16-bit LFSR, which was perfectly matched in software with an equivalent routine, and the output compared with _beq_ and nothing else done with it. (Let me just change that to a _bra_...)

\- 'Encryption' using RC4 with _no key_. Ahahaha _no_.

When people think no-one's going to read it...

<comment><USER4> Eh, I do similar work, but find his whining tone intolerable.

<comment><USER5> Yeah I agree the tone gets tiresome. Just explain it with a higher signal-to- noise ratio and avoid pausing all the time to whine.

Developing software in a corporate environment under the constraints of capatalism often means average management and average coders both with a tight deadline.

Trying to take shortcuts in such an environment is only human nature, and getting non-optimal designs and implementations then should be no surprise.

<comment><USER6> We should be understanding of mediocrity, but we should never accept it as given. As an industry we need to do better -- push back on unrealistic expectations, demand the necessary resources, understand business needs and when they are unjustified.

<comment><USER5> Well said, and in my experience the best way to achieve all this is to let devs have direct contact with end users. Getting the knowledge first hand on what problem they are really trying to solve with your help, and how small tweaks here and there can make them more efficient etc. really gives most devs a sense of urgency. What is required is done, but no more since devs want to put the new version quickly into the hand of the users in the hope that they'll like it.

The complete opposite is fixed requirements specifications and many layers between devs and users. This will get expensive and easily quite mediocre when devs know they are not really building the product the end user needs since motivation so easily falters in such an environment.

</comment></comment></comment></comment></comment><comment><USER5> I learned about mmiotrace which I could find very useful when reverse engineering binary drivers.

The question at the end about why Linux allows user-space access to PCI registers was also very interesting. Apparently it was historically required by X, but should no longer be needed with KMS. Therefore one should in theory be able to disable /dev/mem completely.</comment>


Show HN: Pagerank free search engine - <AUTHOR> http://crrnt.is/

<comment><USER2> How do you call this as search engine? Since it has a UI similar to previous Blekko?

<comment><AUTHOR> Web Search is back up, after a little 'accident' [http://beta.crrnt.is/](http://beta.crrnt.is/)

<comment><AUTHOR> Here is the event log leading to building of CURRENT - [https://medium.com/@chandakmayank/forget-drugs-try- accelerat...](https://medium.com/@chandakmayank/forget-drugs-try- acceleration-b8186d993de7)</comment></comment></comment>


Airbnb wants a copy of my ID to delete my account - <AUTHOR> https://www.reddit.com/r/privacy/comments/euohjj/airbnb_wants_a_copy_of_my_id_to_delete_my_account/ <comment><USER2> I had the same problem with Facebook. My account has been locked, I never provided ID before, and I most certainly will not now. My only remaining task was to delete the account anyway.

What is the gold standard In dealing with these requests?

</comment><comment><USER3> Does anyone know what happens if you send in fake id? I have heard of people's accounts getting hijacked with fake passport scans. Is Facebook really able to authenticate IDs?

</comment><comment><USER4> Facebook does the same, which is annoying as the account I setup and disabled 10 years ago can't be shut down without giving them real PII.

<comment><USER5> The only sane response to FB would be a Kramer-esque "you know who I am dammit!"

</comment></comment><comment><USER6> On the other hand, I would be a upset if a service I used deleted my account without first making quite sure it was me.</comment>


Ask HN: What are some good online collaborative feature request tools? - <AUTHOR>

Hi!! I want to allow users to suggest features for my software, and rank the most important ones. Does anybody know a good and convenient system for that? <comment><USER2> UserVoice is a good option, a lot of SaaS use them.</comment>


jQuery Mobile Alpha 4 Released - <AUTHOR> http://jquerymobile.com/2011/03/jquery-mobile-alpha-4-released/

<comment><USER2> Is it possible to do a single page web app now? By this I mean a single index.html+js files that feeds itself from REST services.

In alpha 3 the stoppers for this was sending paramters between "jquery mobile pages (divs)", and also listviews and other elements could not be dynamically updated without doing some hacks.

Other than that Im very impressed with jQuery Mobile keep up the good work!

</comment><comment><USER3> The demo on an iPhone is very smooth except far the massively jarring page rerenders and the browser bar flashing on every page transitions. Is there really no way to fix these issues? It's depressing because the rest is very nice but these issues are devastating to the overall experience.</comment>


Nokia Siemens Buys Motorola Unit for $1.2 Billion - <AUTHOR> https://www.nytimes.com/2010/07/20/technology/20nokia.html

<comment><AUTHOR> This press release is significantly better than the article, sorry I failed to look for it earlier.

[http://www.nokiasiemensnetworks.com/news-events/press- room/p...](http://www.nokiasiemensnetworks.com/news-events/press-room/press- releases/nokia-siemens-networks-to-acquire-certain-wireless-network-inf)

</comment><comment><USER2> This ought to give Nokia a strong position on the emerging LTE markets, being able to co-design devices and networks. They need more than that however to break into US smartphone markets.

</comment><comment><USER3> I wonder what OS the new smartphones will run. Android or MeeGo?

<comment><USER4> This deal is not for Motorola's mobile phone division.

<comment><USER5> Interesting that Motorola is willing to let go of its telecom equipment business.

Are they are going to focus more on their smartphone division? I mean they've celebrated big successes with their recent Android phones and have implemented all the necessary know how and workflows for integrating Android with their mobile phones. Now they could really start pushing them out!

<comment><USER6> Sounds like they are trying to spin off everything except for their Public Safety radio division.

They have been, and still are, talking about spinning off the smartphone division.</comment></comment></comment></comment>


GridDB vs. Cassandra Benchmarks pitting the two found within - <AUTHOR> https://www.griddb.net/en/blog/griddb-and-cassandra-ycsb-benchmarks/ <comment><USER2> That benchmark stinks of in-memory vs persisted | IO starvation.

What workload in cassandra has no scaling with more nodes?

</comment><comment><USER3> Need add scylladb to the benchmark list

(When it stops crashing)

</comment><comment><USER4> 4 (or 12) millions seems a really small amount of data isn't it ?

<comment><AUTHOR> The benchmark used 4M or 12M records _per node_. For the 32-node test, that would equate to 128M or 384M records respectively. Each record consisted of 10x100 byte fields for the total data size to be 4GB or 12GB per node (or 128GB and 384GB for an entire 32-node cluster).

GridDB's write model keeps hot data in memory up to configured storage limit but will continually write it to persistent storage at the configured checkpoint interval.</comment></comment>


How Julian Jaynes' consciousness theory is faring in the neuroscience age (2015) - <AUTHOR> http://nautil.us/issue/54/the-unspoken/consciousness-began-when-the-gods-stopped-speaking-rp <comment><USER2> Wacky and entertaining idea.

The theory rests on another idea that many people assume is obviously true without ever thinking twice.

It's the notion that verbal thought and verbal thinking is required and fundamental part of consciousness and self awareness.

When I started to read about the philosophy of consciousness, it became obvious that most people experience their own consciousness differently than I do. Their inner starting point is completely off from my personal epistemology and it may be hard for them to see the alternative viewpoint interesting.

For me, verbal thoughts have always been just one cognitive ability in par with spatial reasoning. I have always had trouble understanding why people link verbal thinking and consciousness and self awareness.

Temple Grandin's has really good insight into the differences of thinking: Thinking the Way Animals Do: Unique insights from a person with a singular understanding [http://www.grandin.com/references/thinking.animals.html](http://www.grandin.com/references/thinking.animals.html)

<comment><USER3> _> I have always had trouble understanding why people link verbal thinking and consciousness _

I came across the same conundrum when I was studying psychology. It all came down to the medium becoming the message. Language is the prime means through which we convey experience. Of course there are other means visual, spacial but when you're "studying consciousness" you're typically reading books. Serious treatise in the area are delivered in the form of books. We come to think of thought as being predominantly verbal because that's the predominant means through which we acquire an "objective" appreciation for what consciousness "is". Even to use a word "consciousness" puts that set of concepts in a delineated box. I could go on ... but I risk becoming stream of consciousness ...

<comment><USER2> I had interesting discussion about logical thinking once. My fried claimed that it's impossible to think logically (btw. etymology of word logic is "word" or "what is spoken") without verbally running the the words and sentences in your head. Then I explained that I have always used logic visuospatially. "and" is choice between places or fork in the road, "or" is combining two objects in the same place and so on.

Content of our consciousness seems to be based on sensory input and sensor fusion. Thinking is running simulated sequences and scenarios in our head. Different people use different sensory content more than others. I wouldn't be surprised if some people use feelings or motor imaginary more than others.

We have visuospatial ability, audioverbal perception and motor imagery/proprioception. Interoceptive senses seem to relate feelings somehow. If you really drill and analyze what if feels to love, hate or fear. The feeling is related to our internal senses.

<comment><USER4> > My fried claimed that it's impossible to think logically (btw. etymology of > word logic is "word" or "what is spoken") without verbally running the the > words and sentences in your head.

In this case, would numbers represent "words" in the language of mathematics? When I was younger and sharper, I used to see products of numbers physically manifest in my mind. This is a form of logic, but it also required an "alphabet" of sorts.

As an aside, I once saw an interview with a mathematical genius of sorts who stated that he associated numbers with colors. He saw the product of two numbers as a third color. Again, logic without traditional language.

<comment><USER5> Mathematical proof did not originate with number, but geometry.

</comment></comment></comment></comment></comment><comment><USER6> A lot of people discount Jayne's theory for the inaccuracy regarding its assertions about the physical mechanisms, namely that specific modules in one half of the brain talk across the corpus callosum to specific modules in the other half. But IMO they're throwing the baby out with the bathwater. What I haven't seen yet are investigations into the nature of self-awareness and agency assuming that his theory holds water on the mental aspects. Studies have shown that we make decisions whole seconds before we are conscious of our coming to a conclusion. Could this not be some remnant of the potential fact that our internal decision processes are based around a similar mechanism as what he proposes? The only difference is that we think that "voice" telling us what to do is ourselves, and not some imposition from outside.

</comment><comment><USER7> Crucially, Jayne's definition of "consciousness" is basically introspection. If you replace the word "consciousness" with "introspection", all the controversy evaporates and the story becomes (only mildly) interesting.

> Jaynes ... decides to read early texts, including The Iliad and The Odyssey, > to look for signs of people who aren't capable of introspection—people who > are all sea, no rime. And he believes he sees that in The Iliad. He writes > that the characters in The Iliad do not look inward, and they take no > independent initiative.

Suitcase words like "consciousness" are tricky to work with.

[https://alexvermeer.com/unpacking-suitcase- words/](https://alexvermeer.com/unpacking-suitcase-words/)

<comment><USER8> > Crucially, Jayne's definition of "consciousness" is basically introspection.

With language as a key portion. See any discussion of deaf people who aren't taught language until late in life, such a Helen Keller. The stories consistently have them _emotionally overwhelmed_ when the first learn language. They want to know the names of everything.

And also, they consistently talk about "before" and "after". Before language, they were a collection of emotions, fears, desires, etc. After language, _they_ existed for the first time. They could name things, including themselves.

This looks a lot like the transition to _self aware_ consciousness. Which means Jayne isn't entirely wrong.

<comment><USER9> A quick search yielded something from a book about Keller - do you have some other good sources for what you mention?

</comment></comment></comment><comment><USER10> "O, what a world of unseen visions and heard silences, this insubstantial country of the mind!

A secret theater of speechless monologue and prevenient counsel, an invisible mansion of all moods, musings, and mysteries, an infinite resort of disappointments and discoveries."

If you're intrigued reading the article, or have had the book on your 'todo' for years now I'd really encourage you to just go get a copy and take it on. It provides a wealth of food for thought - a lovely example of a theory that in all likelihood is in its details totally wrong, but enriches the reader regardless.

</comment><comment><USER11> I think the trigger event for modern consciousness mode is a critical percent of population being literate. It could been happening a few millenia earlier than his book suggests, and shaped the brain around reading the "fixed language"(i.e. written words) allowing abstraction levels not possible with earlier purely verbal communication. [https://en.wikipedia.org/wiki/Reading_(process)#History](https://en.wikipedia.org/wiki/Reading_\(process\)#History) The history of reading dates back to the invention of writing during the 4th millennium BC. Although reading print text is now an important way for the general population to access information, this has not always been the case. With some exceptions, only a small percentage of the population in many countries was considered literate before the Industrial Revolution. Some of the pre-modern societies with generally high literacy rates included classical Athens and the Islamic Caliphate.[41]

Scholars assume that reading aloud (Latin clare legere) was the more common practice in antiquity, and that reading silently (legere tacite or legere sibi) was unusual.[42] In his Confessions, Saint Augustine remarks on Saint Ambrose's unusual habit of reading silently in the 4th century AD.[42][43]

</comment><comment><USER8> Neal Stephenson's novel "Snow Crash" depended entirely on this theory. I'm not sure if I believe it, but it made for a good novel.

</comment><comment><USER12> These ideas are mentioned by the character of Ford (played by Anthony Hopkins) in Westworld, in regards to creating consciousness in robots, and they made quite a bit of sense to me in that context.

</comment><comment><USER13> For those interested in thoughts about consciousness, I highly recommend Bernardo Kastrup.

He comes from a comp sci background but has several books and very well structured arguments for Idealism. His manner of delivering his insights I think particularly appeal to those with analytical and critical thinking backgrounds.

He has several very good videos on YouTube as well.

[https://www.goodreads.com/author/show/4552692.Bernardo_Kastr...](https://www.goodreads.com/author/show/4552692.Bernardo_Kastrup)

[https://www.youtube.com/user/bernardokastrup/](https://www.youtube.com/user/bernardokastrup/)

</comment><comment><USER14> I've been familiar with this idea for a while, although whenever it comes up, I can't help but think about Hitchens's razor:

"What can be asserted without evidence can be dismissed without evidence"

</comment><comment><USER15> Any useful theory of consciousness has to be able to explain animal consciousness too. Language is really the only differentiator between us and other primates, cognitively. (naturally it's a powerful difference) Primates far and away clear the bar for sentience, we know enough about dogs and cats to grudgingly accept them into the fold too. Plenty of birds are extremely intelligent and social as well.

<comment><USER3> _Language is really the only differentiator between us and other primates, cognitively_

I don't agree. Many other types of animals have rudimentary languages, but I wouldn't dispute the sophistication of human language towers above all others, that in itself rests (along with other uniquely sophisticated behavioural endowments) upon what really differentiates us which is the capacity for imagination and abstract thought. The capability to imagine things that aren't actually real, but perhaps could be. It's thought that the seat of all this is the frontal cortex but I see now on wikipedia that is contentious these days [0]

[0] [https://en.wikipedia.org/wiki/Frontal_lobe#In_other_animals](https://en.wikipedia.org/wiki/Frontal_lobe#In_other_animals)

<comment><USER16> I have pets and they try to entertain themselves when they are board. Seems like thet are thinking abstractly with limitations imposed by body and brain.

<comment><USER3> I don't think it's the same. They can't reason about what they're doing abstractly. That's why they're acting it out.

<comment><USER16> This ape took a selfie all on his own just as good as any human. [https://timedotcom.files.wordpress.com/2015/09/monkey- selfie...](https://timedotcom.files.wordpress.com/2015/09/monkey- selfie.jpg?quality=85)

<comment><USER3> Ape is a corner case, they're the only species we know of that share to a limited extent the enlarged forebrain that humans have.

A single outlying data-point hardly disproves a theory, and even so, you can't possibly know that the monkey knew what he was doing. It could just be mimicry. Your thinking about what the monkey is thinking is distinctly the distinguishing trait of human psyche I'm talking about.

EDIT: Also relevant. Operant theory can explain seemingly "intelligent" behaviour as random or observed and mimicked actions that are then reinforced by the environment [0]

Your monkey's behaviour could be explained in a similar vein to that which explains "cargo cult" behaviour [1].

Now, you could say that this is indeed "intelligent" behaviour, but then again a dog can be trained to open a door, and pigeons can be trained to orient themselves based on a clicker [2]. But what I'm talking about here is what _distinguishes_ human intelligence from other forms of life on this planet.

[0] [https://en.wikipedia.org/wiki/Operant_conditioning#Origins_o...](https://en.wikipedia.org/wiki/Operant_conditioning#Origins_of_operant_behavior:_operant_variability)

[1] [https://en.wikipedia.org/wiki/Cargo_cult#First_occurrences](https://en.wikipedia.org/wiki/Cargo_cult#First_occurrences)

[2] [https://www.youtube.com/watch?v=TtfQlkGwE2U](https://www.youtube.com/watch?v=TtfQlkGwE2U)

</comment></comment></comment></comment></comment></comment><comment> Method-X If you find this sort of thing interesting, I highly recommend HBO's Westworld. It's really well done and thoroughly thought provoking.

<comment><USER17> That series brought me to read about the theory.

But almost all pschological educated people I talked to found it too muddy.

</comment></comment><comment><USER18> There seems to be an accepted idea that ancient people had a totally different way of thinking: that up to around 300 BC, humans navigated through the world with a dream-like, pre-scientific logic, and didn't view the world as comprehensible or subject to predictable laws and patterns.

I've always wondered, do we actually know this for sure? What's the evidence? Just by introspection, it is so hard for me to imagine being in a state of mind where I didn't believe that if I dropped a rock off a cliff twice, under similar conditions, it would do pretty much the same thing the second time. Or that if I did it over and over again, I would start to see patterns that I could rely on for later. This feels as hard-wired as just about anything in my mind.

To me, it makes more sense to think that humans have always thought the same way, and these days we just have better tools and have learned to refine the cognitive abilities that are wired into us. But I'm really interested to hear the case for the other side.

<comment><USER19> I don't think that's a generally accepted idea at all. It's an idea that, in various forms, some modern philosophers have floated. Because it's so radical it's something you'll hear (and remember) people chatter about, but that doesn't mean many people take it literally, especially people familiar with ancient works.

At best I think such ideas help challenge beliefs about ourselves in the modern era. At worst I think they perpetuate a tendency for people to dehumanize those whom we can't personally identify with.

<comment><USER18> I'm glad to hear that. I've definitely seen it mentioned by a bunch of experts/academics as if it were accepted fact (Jordan Peterson is the only one that comes right to mind).

I think the idea might partly come from the dream-like quality of ancient myths, but I feel like that underestimates the ability of people to partition those myths from daily life. It's not like our current religious stories are exactly logical.

</comment></comment></comment><comment><USER20> previous discussion

[https://news.ycombinator.com/item?id=9617268](https://news.ycombinator.com/item?id=9617268)

</comment><comment><USER21> Discussed at the time: [https://news.ycombinator.com/item?id=9617268](https://news.ycombinator.com/item?id=9617268).

</comment><comment><USER22> I had a couple of episodes of sleep paralysis where I experienced auditory hallucinations. Often times, the voices I heard were clear as day, which was strange since I wore ear plugs during a lot of these experiences.

Also, I saw an article on the news about a treatment involving VR for people who hears voices in their head. In the video, the person described the voices as distinct and she could even interact with them.

So I would say there's something to explore there.

<comment><USER23> For me this is one of the most interesting concepts which has only been briefly touched on -

Jaynes proposes that in the Iliad the Greeks "heard the voices of the gods" and used those to make decisions. In our modern society I'm sure a lot of religious people would find God(s) speaking directly to them a fabrication of the mind, but auditory hallucinations are common and well documented. I often find on the edge of sleep I can lucidly think of a tune or song and hear at as clearly as if it was actually being played in the room.

I think Jaynes made a really interesting observation about older theistic societies that took for granted the ability for people to receive instructions in their heads from the gods. It seems commonplace in religious literature at the least that people can interact with gods and hear what they have to say, something which we tend to interpret more as a metaphor nowadays.

If we reject his theory on consciousness as being a modern substitute for heavenly direction, I don't think that necessarily rules out a cognitive function that we've lost over the past few thousand years - one which could have developed from a young age by not writing off auditory hallucinations as mental noise...

</comment></comment><comment><USER24> I haven't read the book so this may just be an easy to refute idea, but it seems to me if introspection is a cultural construct that grew out of necessity then there should be mechanisms to disprove this theory in the modern day. For example, by looking for evidence of introspection in cultures that are isolated from modern civilization or in individuals who were raised in isolation.

</comment><comment><USER25> I read that book about 15 years ago, it's a fantastic read. I picked it up because either Dennett or Dawkins called it something like "the most insightful and thought provoking idea that is probably not true" (I think it was the latter).

</comment><comment><USER26> As a Computer Engineer by training I am curious about the field of research regarding conciousness.

Is there any contemporary book or resource that summarizes the current academic views and discoveries on the subject?

</comment><comment><USER27> So other people are rewatching Westworld too? :)

</comment><comment><USER28> From 2015.

<comment><USER29> And it's really hard to verify what people heard in the past. "Our kings, presidents, judges, and officers begin their tenures with oaths to the now- silent deities, taken upon the writings of those who have last heard them." How do we know that they weren't just doing poetry or fiction, or creating religion to control the masses?

<comment><USER30> Nietzsche wrote at length about the "death of god," which was his way of symbolizing the unseating of god from society's abstract throne, and the dangerous power vacuum that blood would be shed to re-fill. You can't walk three feet through the past couple centuries before finding some text discussing, cheering on or mourning the transition from a society where god is generally assumed to be behind things to one where he isn't.

If a similar phase change had occured 3000 years ago, I'm pretty sure it would have been well-documented. I have a hard time believing that this event is for the first time being seen clearly from a vantage point three thousand years distant!

<comment><USER31> > If a similar phase change had occured 3000 years ago, I'm pretty sure it > would have been well-documented

Documented where?

The Sapiens book makes a similar assertion, that something changed in the brain about 10000 years ago, when agriculture was invented.

Before that people hunted and gathered for 200k years with little progress and suddenly there was an explosion.

</comment></comment></comment></comment><comment><USER32> Sum ergo cogito always made much more sense to me</comment>


Wikipedia Bans Church of Scientology  - <AUTHOR> http://www.wired.com/business/2009/05/wikipedia-bans-church-of-scientology/ <comment><USER2> This happened in 2009. Just because its on the Reddit front page doesn't mean we need to see it again.</comment>


Usethis interviews John McAfee - <AUTHOR> https://usesthis.com/interviews/john.mcafee/ <comment><USER2> "research chemicals from China" are a helluva drug</comment>


MarioNETte: Few-Shot Face Reenactment Preserving Identity of Unseen Targets - <AUTHOR> https://hyperconnect.github.io/MarioNETte/ <comment><AUTHOR> \- Project page: [https://hyperconnect.github.io/MarioNETte/](https://hyperconnect.github.io/MarioNETte/) \- Paper: [https://arxiv.org/abs/1911.08139](https://arxiv.org/abs/1911.08139) \- Video: [https://youtu.be/Y6HE1DtdJHg](https://youtu.be/Y6HE1DtdJHg)

Here's a summary of the work. We can perform face reenactments under a few- shot or even a one-shot setting, where only a single target face image is provided. Previous approaches to face reenactments had a hard time preserving the identity of the target and tried to avoid the problem through fine-tuning or choosing a driver that does not diverge too much from the target. We tried to tackle this "identity preservation problem" through several novel components.

Instead of working with a spatial-agnostic representation of a driver or a target, we encode the style information to a spatial-information preserving representation. This allows us to maintain the details that easily get lost when utilizing spatial-agnostic representation such as those attained from AdaIN layers.

We proposed image attention blocks and feature alignment modules to attend to a specific location and warp feature-level information as well. Combining attention and flow allows us to naturally deal with multiple target images, making the proposed model to gracefully handle one-shot and few-shot settings without resorting to reductions such as sum/max/average pooling.

Another part of the contribution is the landmark transformer, where we alleviate the identity preservation problem even further. When the driver's landmark differs a lot from that of the target, the reenacted face tends to resemble the driver's facial characteristics. Landmark transformer disentangles the identity and expression and can be trained in an unsupervised fashion.

Check out the video and tell us what you think. Thanks!

<comment><USER2> Great work. Any code available please?

<comment><AUTHOR> We're internally discussing the code release at the moment. Meanwhile, we did try to include all the details required to reproduce the results on the paper. You're welcome to try out your own implementation and ask us questions regarding the implementation details.</comment></comment></comment>


ARE YOU CURIOUS? GO WATCH THE PROJECT - <AUTHOR> http://littlebigjourney.strikingly.com/ <comment><USER2> Bad title style for this site. Perhaps it work in other sites, but not here ...

Try submitting again once with this title: "Little Big Journey: Immersive 3D VR"

The preferred title here is the original title, or the subtitle, or a sentence of the abstract. I choose one of the headers, because it's more descriptive, I hope it's not too far from the guidelines. More details [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

By the way, you have the Caps Lock on.</comment>


Matrix.org Got Hacked - <AUTHOR> https://twitter.com/matrixdotorg/status/1116304867683905537 <comment><AUTHOR> What bugs me is this statement:

> Summary is: an attacker accessed the production infra that runs (link: > [http://matrix.org](http://matrix.org)) matrix.org, hence the rebuild. > Source code & packages are unaffected.

> We do not think user data was targeted, but are playing it safe.

They don't think "user data was targeted"? I mean chat is super sensible information, how can you assume this?

What could have been the case is that their possible vulnerable Wordpress instance got compromised?

I hope they had their Linux host properly secured, judging by their documentation on hosting I don't see their strengths in hosting infrastructure, but I don't know who is actually hosting this infrastructure.

[https://www.shodan.io/host/188.8.131.52](https://www.shodan.io/host/126.96.36.199)

[https://www.shodan.io/host/22.214.171.124](https://www.shodan.io/host/126.96.36.199)

PS: Kudos for their quick public communication, I hope there is going to be a recap soon.

<comment><USER2> The reason we think that user data wasn't the target is based on looking at the attacker's trail, which appears more focused on seeking additional credentials rather than exfiltrating user data.

[https://matrix.org/blog/2019/04/11/security- incident/](https://matrix.org/blog/2019/04/11/security-incident/) is a recap of the situation.

In other news, [https://news.ycombinator.com/user?id=matrixdotorg](https://news.ycombinator.com/user?id=matrixdotorg) isn't an official account for matrix.org, nor are they likely associated with the project.

<comment><AUTHOR> How/why do you refer to this account?

<comment><USER2> because they commented on this thread impersonating Matrix.org, before some kind of HN moderation mechanism kicked in and removed the comment entirely.

<comment><AUTHOR> Oh, thank you for clarifying.

</comment></comment></comment></comment></comment><comment><USER3> I was wondering why I was receiving 404s and 500s all day.</comment>